Is there going to be CVE support with remote storage

[bfreidank]

While implementing s3 remote storage for a Zot instance it was noted that CVE scanning is not supported. Is there an intention to implement support for CVE scanning? If not what is the reason for not supporting it?

[andaaron]

Hi @bfreidank,
We need the local storage for Trivy to download and maintain the CVE DBs.
Unless they start supporting another DB (as far as I know today they only support bolt), there's not much we can do.

[marvkis]

Hi @andaaron ,
I stumbled over this too.
From what you said - Trivy needs local storage for it's database - it might work if we configure a rootDirectory for the topmost storage and have some subPath configurations with s3 locations.
From the source it looks like it also doesn't allow remote storage on subPath entries either:
https://github.com/project-zot/zot/blob/v2.1.3-rc4/pkg/cli/server/root.go#L356
Is there anything else blocking this use case? I.e. Trivy is not able to scan images stored on a (s3) remote storage?
Thanks for all your work on this project!

[rchincha]

That would be the main reason. But also consider that every image needs to be read, unpacked and scanned - everyday. So S3 backend is not an ideal choice.

A workaround would be to run a zot with an s3 backend and another local zot mirror pointing to the first zot so that CVE scans can be enabled.